RowHammer, ThrowHammer and NetHammer attacks - Revision history

NKirnbauer: link that doesnt exist

2024-09-02T11:19:48Z

link that doesnt exist

← Older revision		Revision as of 11:19, 2 September 2024
Line 117:		Line 117:

	== Used Hardware ==		== Used Hardware ==
			HP Pavilion Desktop PC with DDR3 RAM and Ivy-Bridge architecture
	[[HP Pavilion Desktop PC with DDR3 RAM and Ivy-Bridge architecture]]

	== References ==		== References ==

NKirnbauer: fixed link

2024-08-27T18:00:35Z

fixed link

← Older revision		Revision as of 18:00, 27 August 2024
Line 129:		Line 129:
	* R.-F. Huang, H.-Y. Yang, M. C.-T. Chao, and S.-C. Lin, “Alternate hammering test for application-specific drams and an industrial case study,” Proceedings of the 49th Annual Design Automation Conference on - DAC 12, 2012.		* R.-F. Huang, H.-Y. Yang, M. C.-T. Chao, and S.-C. Lin, “Alternate hammering test for application-specific drams and an industrial case study,” Proceedings of the 49th Annual Design Automation Conference on - DAC 12, 2012.
	* P. C.-F. Chia, S.-J. Wen, and S. H. Baeg, “New dram hci qualification method em- phasizing on repeated memory access,” 2010 IEEE International Integrated Reliability Workshop Final Report, 2010.		* P. C.-F. Chia, S.-J. Wen, and S. H. Baeg, “New dram hci qualification method em- phasizing on repeated memory access,” 2010 IEEE International Integrated Reliability Workshop Final Report, 2010.
	* M. Seaborn and T. Dullien., Jan 1970. [Online]. Available: https://googleprojectzero. blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html		* M. Seaborn and T. Dullien., Jan 1970. [Online]. Available: https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
	* “throwhammer: rowhammer attacks over the network and defenses.” [Online]. Available: https://www.usenix.org/system/files/conference/atc18/atc18-tatar.pdf		* “throwhammer: rowhammer attacks over the network and defenses.” [Online]. Available: https://www.usenix.org/system/files/conference/atc18/atc18-tatar.pdf
	* M. Lipp, M. Schwarz, L. Raab, L. Lamster, M. T. Aga, C. Maurice, and D. Gruss, “Nethammer: Inducing rowhammer faults through network requests,” 2020 IEEE Eu- ropean Symposium on Security and Privacy Workshops, 2020.		* M. Lipp, M. Schwarz, L. Raab, L. Lamster, M. T. Aga, C. Maurice, and D. Gruss, “Nethammer: Inducing rowhammer faults through network requests,” 2020 IEEE Eu- ropean Symposium on Security and Privacy Workshops, 2020.

	[[Category:Basic]]		[[Category:Basic]]

TNicholson at 09:43, 8 January 2024

2024-01-08T09:43:10Z

@@ Line 2: / Line 2: @@
 In this paper, I presented and compared the different attacks about RowHammer, ThrowHammer and NetHammer but the special focus was lying on the RowHammer attack because this attack is the basis of the other attacks. Firstly, I gave an overview about the Internet, personal computers on households and how the technology developed year by year in order to bring a better feeling of understanding about todays capabilities and possibilities. Subsequently I demonstrated some details about the RAM, DRAM and also explained for what they will be used because these components are very important components of machines like computer. They are very affected by those attacks. Furthermore I described the attacks beginning by the RowHammer attack and how it works and what it uses in order to make the attack happen.
 == Requirements for RowHammer attack ==
@@ Line 30: / Line 40: @@
 == Description ==
 === RowHammer ===

TNicholson at 09:37, 8 January 2024

2024-01-08T09:37:32Z

← Older revision		Revision as of 09:37, 8 January 2024
Line 118:		Line 118:
	== Used Hardware ==		== Used Hardware ==

	[[~~MacBook Pro 2019, macOS Big Sur, Version 11.6~~]]		[[HP Pavilion Desktop PC with DDR3 RAM and Ivy-Bridge architecture]]

	== References ==		== References ==

TNicholson at 09:34, 8 January 2024

2024-01-08T09:34:59Z

← Older revision		Revision as of 09:34, 8 January 2024
Line 99:		Line 99:
	* DRAMA (https://github.com/IAIK/drama)		* DRAMA (https://github.com/IAIK/drama)
	This tool is used to reverse-engineer the DRAM mappings - this is required so that specific rows can be targeted easily.		This tool is used to reverse-engineer the DRAM mappings - this is required so that specific rows can be targeted easily.

			* git clone https://github.com/IAIK/drama
			* cd drama/re
			* make
			* taskset 0x4 sudo ./measure -p 0.75 -s 16 (allocate 75% of DRAM for measurement, expect 16 sets) - After some time - this will output the most likely DRAM mappings


	* Rowhammer.js (https://github.com/IAIK/rowhammerjs)		* Rowhammer.js (https://github.com/IAIK/rowhammerjs)
	The "native" folder of this repository contains the source code for a simple Rowhammer attack. The code can be compiled for Haswell, Skylake and Ivybridge architectures. But first, the DRAM mappings from the DRAMA tool need to written into the source code. This way, the correct rows are hammered. If any bit flips are found, they will be output in the console.		The "native" folder of this repository contains the source code for a simple Rowhammer attack. The code can be compiled for Haswell, Skylake and Ivybridge architectures. But first, the DRAM mappings from the DRAMA tool need to written into the source code. This way, the correct rows are hammered. If any bit flips are found, they will be output in the console.

			* git clone https://github.com/IAIK/rowhammerjs
			* cd rowhammerjs/native
			* nano rowhammer.cc and insert the DRAM mappings for your specific architecture (see image)
			* make rowhammer-ivy (for Ivybridge systems, adapt this command to your own architecture)
			* ./rowhammer-ivy -d 2 -f 0 (two dimms, hammer only offset zero to increase attack speed)

TNicholson at 09:26, 8 January 2024

2024-01-08T09:26:13Z

← Older revision		Revision as of 09:26, 8 January 2024
Line 85:		Line 85:
	The NetHammer attack is actually a RowHammer attack which is neither relying on any attacker controlled code on the victim computer or RDMA enabled network cards. So it does not require local code execution. It only needs a fast network connection between the attacker and the victim. This attack sends a crafted stream of small network packets to the target computer a one-location or single-sided RowHammer attack. Single-sided hammering is when accessing 8 randomly chosen memory locations simultaneously and there the probability is high that at least 2 out of 8 random memory locations will be mapped into the same out of 32 DRAM banks on DDR3. DDR3 is Double Data Rates 3 which is a SDRAM type. One-location hammering is when only accessing one single location at a high frequency. In this access pattern the attacker does not directly cause row conflicts but instead it keeps re-opening one row permanently. Each packet that is received on the target device, a set of addresses is accessed for example in a user-space application processing the contents, in the kernel driver, somewhere in between or a combination of all. So when sending packets rapidly and repeatedly, those set of addresses are hammered and therefore bit flips can occur. So to make remotely bit flips happen it is needed to send as many packets as possible, as fast as possible and in a short time frame over a the network. For example, UDP (User Datagram Protocol) packets without any specific content can be used for this attack. On those UDP packets it should be allowed to have an overall packet size of 64 B (Byte) which is the minimum packet size for an Ethernet packet. Ethernet has also a maximum frame size of 1518 B. With this it is possible to send up to 1 024 000 packets per second over a 500 Mbit per second connection.		The NetHammer attack is actually a RowHammer attack which is neither relying on any attacker controlled code on the victim computer or RDMA enabled network cards. So it does not require local code execution. It only needs a fast network connection between the attacker and the victim. This attack sends a crafted stream of small network packets to the target computer a one-location or single-sided RowHammer attack. Single-sided hammering is when accessing 8 randomly chosen memory locations simultaneously and there the probability is high that at least 2 out of 8 random memory locations will be mapped into the same out of 32 DRAM banks on DDR3. DDR3 is Double Data Rates 3 which is a SDRAM type. One-location hammering is when only accessing one single location at a high frequency. In this access pattern the attacker does not directly cause row conflicts but instead it keeps re-opening one row permanently. Each packet that is received on the target device, a set of addresses is accessed for example in a user-space application processing the contents, in the kernel driver, somewhere in between or a combination of all. So when sending packets rapidly and repeatedly, those set of addresses are hammered and therefore bit flips can occur. So to make remotely bit flips happen it is needed to send as many packets as possible, as fast as possible and in a short time frame over a the network. For example, UDP (User Datagram Protocol) packets without any specific content can be used for this attack. On those UDP packets it should be allowed to have an overall packet size of 64 B (Byte) which is the minimum packet size for an Ethernet packet. Ethernet has also a maximum frame size of 1518 B. With this it is possible to send up to 1 024 000 packets per second over a 500 Mbit per second connection.

			=== Flip Feng Shui ===

			Flip Feng Shui is a highly advanced implementation of Rowhammer capable of flipping bits in a controlled way anywhere in the software. Memory deduplication allows attackers to map a physical page onto a virtual page they own, as long as the page content is known. Rowhammer is then used to flip bits in locations of the target page. The developers of this technique managed to compromise the public RSA keys in the OpenSSH authorized_keys file, making them easier to factorize. They were then able to generate a private key and logged into the server.

			Using the same techniques, they also flipped bits in the sources.list file, changing ubuntu.com to e.g. ubunvu.com (one bit flip away from the legitimate domain). The researchers registered these domains and served a malicious package update from it. By additionally manipulating the trusted.gpg file, they tricked the victim VM into verifying and installing a malicious update.

	=== DRAMA and Rowhammer.js ===		=== DRAMA and Rowhammer.js ===

TNicholson at 09:21, 8 January 2024

2024-01-08T09:21:02Z

← Older revision		Revision as of 09:21, 8 January 2024
Line 6:		Line 6:

	* Have access to local computer		* Have access to local computer
	* ~~Execute local code which rapidly and repeatedly reopens rows on~~ DRAM ~~cells~~		* Access to memory must not be cached - otherwise, the DRAM is never reached
			* Memory access must be very fast (race against the refresh time)
			* Memory access must be performed in a very targeted way - only specific combinations of proximate row access may cause bit flips
	* This cause bit flips on adjacent rows		* This cause bit flips on adjacent rows

TNicholson at 09:18, 8 January 2024

2024-01-08T09:18:10Z

← Older revision		Revision as of 09:18, 8 January 2024
Line 82:		Line 82:

	The NetHammer attack is actually a RowHammer attack which is neither relying on any attacker controlled code on the victim computer or RDMA enabled network cards. So it does not require local code execution. It only needs a fast network connection between the attacker and the victim. This attack sends a crafted stream of small network packets to the target computer a one-location or single-sided RowHammer attack. Single-sided hammering is when accessing 8 randomly chosen memory locations simultaneously and there the probability is high that at least 2 out of 8 random memory locations will be mapped into the same out of 32 DRAM banks on DDR3. DDR3 is Double Data Rates 3 which is a SDRAM type. One-location hammering is when only accessing one single location at a high frequency. In this access pattern the attacker does not directly cause row conflicts but instead it keeps re-opening one row permanently. Each packet that is received on the target device, a set of addresses is accessed for example in a user-space application processing the contents, in the kernel driver, somewhere in between or a combination of all. So when sending packets rapidly and repeatedly, those set of addresses are hammered and therefore bit flips can occur. So to make remotely bit flips happen it is needed to send as many packets as possible, as fast as possible and in a short time frame over a the network. For example, UDP (User Datagram Protocol) packets without any specific content can be used for this attack. On those UDP packets it should be allowed to have an overall packet size of 64 B (Byte) which is the minimum packet size for an Ethernet packet. Ethernet has also a maximum frame size of 1518 B. With this it is possible to send up to 1 024 000 packets per second over a 500 Mbit per second connection.		The NetHammer attack is actually a RowHammer attack which is neither relying on any attacker controlled code on the victim computer or RDMA enabled network cards. So it does not require local code execution. It only needs a fast network connection between the attacker and the victim. This attack sends a crafted stream of small network packets to the target computer a one-location or single-sided RowHammer attack. Single-sided hammering is when accessing 8 randomly chosen memory locations simultaneously and there the probability is high that at least 2 out of 8 random memory locations will be mapped into the same out of 32 DRAM banks on DDR3. DDR3 is Double Data Rates 3 which is a SDRAM type. One-location hammering is when only accessing one single location at a high frequency. In this access pattern the attacker does not directly cause row conflicts but instead it keeps re-opening one row permanently. Each packet that is received on the target device, a set of addresses is accessed for example in a user-space application processing the contents, in the kernel driver, somewhere in between or a combination of all. So when sending packets rapidly and repeatedly, those set of addresses are hammered and therefore bit flips can occur. So to make remotely bit flips happen it is needed to send as many packets as possible, as fast as possible and in a short time frame over a the network. For example, UDP (User Datagram Protocol) packets without any specific content can be used for this attack. On those UDP packets it should be allowed to have an overall packet size of 64 B (Byte) which is the minimum packet size for an Ethernet packet. Ethernet has also a maximum frame size of 1518 B. With this it is possible to send up to 1 024 000 packets per second over a 500 Mbit per second connection.


			=== DRAMA and Rowhammer.js ===

			Researchers from the TU Graz have published two very helpful tools which anyone can use to check if their computer is vulnerable to Rowhammer - more specifically, Rowhammer based on the cache eviction technique. The tools run on Linux Intel Ivybridge, Haswell or Skylake systems. It will only work against DDR3 DRAM.

			Here is a demo of both tools provided by the authors: https://www.youtube.com/watch?v=X8-X_52rg80&ab_channel=DanielGruss

			* DRAMA (https://github.com/IAIK/drama)
			This tool is used to reverse-engineer the DRAM mappings - this is required so that specific rows can be targeted easily.

			* Rowhammer.js (https://github.com/IAIK/rowhammerjs)
			The "native" folder of this repository contains the source code for a simple Rowhammer attack. The code can be compiled for Haswell, Skylake and Ivybridge architectures. But first, the DRAM mappings from the DRAMA tool need to written into the source code. This way, the correct rows are hammered. If any bit flips are found, they will be output in the console.


	== Used Hardware ==		== Used Hardware ==

ECelik: /* ThrowHammer */

2021-11-08T17:03:44Z

ThrowHammer

← Older revision		Revision as of 17:03, 8 November 2021
Line 75:		Line 75:


	[[File:non-rdma.png\|thumb\|none\|600px\|Source: https://~~securityaffairs~~.co/~~wordpress~~/~~72377~~/~~hacking~~/~~throwhammer-rowhammer~~-~~attack~~.~~html~~]]		[[File:non-rdma.png\|thumb\|none\|600px\|Source: https://www.usenix.org/system/files/conference/atc18/atc18-tatar.pdf]]

	In order to transfer packets efficiently ThrowHammer makes use of RDMA capabilities. Sending packets rapidly and frequently over a high speed network may cause bit flips on the target system because of RDMA.		In order to transfer packets efficiently ThrowHammer makes use of RDMA capabilities. Sending packets rapidly and frequently over a high speed network may cause bit flips on the target system because of RDMA.

ECelik: /* ThrowHammer */

2021-11-08T16:53:46Z

ThrowHammer

← Older revision		Revision as of 16:53, 8 November 2021
Line 75:		Line 75:


	[[File:non-rdma.png\|600px\|]]		[[File:non-rdma.png\|thumb\|none\|600px\|Source: https://securityaffairs.co/wordpress/72377/hacking/throwhammer-rowhammer-attack.html]]

	In order to transfer packets efficiently ThrowHammer makes use of RDMA capabilities. Sending packets rapidly and frequently over a high speed network may cause bit flips on the target system because of RDMA.		In order to transfer packets efficiently ThrowHammer makes use of RDMA capabilities. Sending packets rapidly and frequently over a high speed network may cause bit flips on the target system because of RDMA.